Technical Tip: Splitting FortiEDR Central Manager and FortiEDR Aggregator

[rduggal_FTNT]

Description	This article describes how to split FortiEDR Central Manager and Aggregator running on the same server to dedicated Servers to address scalability issues.
Scope	Specific to FortiEDR Central Manager and Aggregator when running on the same Server.
Solution	This method is useful when FortiEDR Central Manager and Aggregator are hosted on-premise and running on the same Server. Note: In this Knowledge-based article, it will be used Visual Editor to edit files (vi), however, it is possible to use any desired editor. SSH to Server running FortiEDR Manager and Aggregator. Login using root credentials. Execute commands 'fortiedr status' and 'fortiedr manager status' to determine the status. Output should be like below: Disable the FortiEDR aggregator role by executing the command 'fortiedr aggregator disable': Edit the below file to change the machine role: vi /opt/FortiEDR/webapp/application-customer.properties change machine.role=both    --> It will show machine.role as both, it is necessary to change this to manager as below: change machine.role=manager      --> Save and exit the file. Edit the below file to change the machine role: vi /opt/FortiEDR/platform/conf/platform.conf change role=both    --> It will display role as both, it is necessary to change this to manager as below: change role=manager                --> Save and exit the file. Stop the nginx Service using the command 'systemctl stop nginx' and verify the status using the command 'systemctl status nginx'. Change the IP address of the Manager. It will be used an existing IP on the new aggregator to prevent any registration issues with existing registered collectors. Type 'ifconfig' and record the interface name. Edit the interface using the command 'vi /etc/sysconfig/network-scripts/ifcfg-ens33' and change the IP, save, and exit' Toggle interface for the new IP to take effect using the command 'ifdown ens33 && ens33'. Shut down the Manager's VM. Set up a new VM as FortiEDR aggregator and assign the same IP as it was assigned to the VM which was running as both FortiEDR Manager and Aggregator (As per the above example this shall be 192.168.70.244/24). Refer to the below link to setup a new VM as a FortiEDR aggregator. Setting up a VM to be the FortiEDR Aggregator Power on Manager VM and check 'fortiedr status'. Output should be like below: Test from new aggregator 'curl -v telnet://manager:443'. If there are still any issues during the installation, open a new technical support ticket for further assistance: Support Fortinet